Checkmarx KICS Docker Images and Extensions Compromised to Steal Developer Secrets

Summary

Socket says trojanized Checkmarx KICS images and extensions delivered credential-stealing malware. The malicious Docker digest was served for about 84 minutes; TeamPCP claimed responsibility, but attribution remains unconfirmed.

Key points

Socket found compromised KICS Docker images and VS Code/Open VSX extensions delivering a hidden MCP addon that fetched mcpAddon.js from a hardcoded GitHub URL.
The malware targeted GitHub tokens, AWS, Azure and Google Cloud credentials, npm tokens, SSH keys, Claude configurations and environment variables.
Researchers say the malware encrypted and exfiltrated data to audit.checkmarx[.]cx and automatically created public GitHub repositories.
The malicious Docker digest was served from 2026-04-22 14:17:59 UTC to 15:41:31 UTC; affected tags have since been restored and the fake v2.1.21 tag deleted.
TeamPCP publicly claimed responsibility, but researchers said pattern-based correlations were insufficient to confirm attribution.
Checkmarx says it removed malicious artifacts, revoked and rotated exposed credentials, and is investigating. Users are advised to rotate secrets and use pinned SHAs and safe versions.

Article Details

Victim Organization: Checkmarx
Victim Domain: Unknown
Incident Type: Supply-chain compromise involving trojanized KICS Docker images and VS Code/Open VSX extensions that delivered credential-stealing malware.
Incident Date: 2026-04-22
Data Types Exposed: GitHub tokens
AWS credentials
Azure credentials
Google Cloud credentials
npm tokens
SSH keys
Claude configurations
Environment variables
Affected Records: Unknown
Affected Data Size: Unknown
Operational Impact: Malicious artifacts were removed and affected Docker tags restored; Checkmarx revoked and rotated exposed credentials and is investigating with external experts. Users were advised to treat secrets as compromised, rotate them, and rebuild from a known safe point.
Ransom Or Extortion: Unknown
Claim Status: confirmed

Indicators of compromise

Type	Indicator	Context
DOMAIN	`audit[.]checkmarx[.]cx`	Identified as an exfiltration destination for stolen developer secrets; described as impersonating legitimate Checkmarx infrastructure.
DOMAIN	`checkmarx[.]cx`	Users were advised to block access to this domain, which the article associates with the malicious infrastructure.
IPV4	`91[.]195[.]240[.]123`	IP address users were advised to block in connection with the malicious checkmarx.cx domain.
IPV4	`94[.]154[.]172[.]43`	IP address users were advised to block in connection with the credential-exfiltration domain audit.checkmarx.cx.